CVE-2024-14003 is a critical (CVSS 9.8) remote code execution flaw in Nagios XI versions before 2024R1.2. Inbound NRDP request parameters were not validated well enough, so crafted input could reach command execution. Upgrade to 2024R1.2 or later and limit network access to the NRDP endpoint.
What's affected
Nagios XI versions prior to 2024R1.2 are affected. The fix is 2024R1.2 or later.
The flaw sits in the NRDP server plugins. NRDP is the Nagios Remote Data Processor, which accepts check results from remote systems over HTTP. The description says insufficient validation of inbound request parameters lets crafted input reach command execution paths.
Commands run on the underlying host in the context of the web or Nagios service. The VulnCheck advisory rates it critical. The Nagios changelog is the source for which release carries the change.
How to check if you're exposed
Nagios XI shows its version in the web interface after login, and on a default Linux install the version file can be read from the shell:
grep full /usr/local/nagiosxi/var/xiversion
If the output shows a release older than the fixed version above, treat the server as affected. If the path differs on your install, use the version shown in the Nagios XI web interface or follow the steps in the vendor changelog.
Also list which hosts can reach the NRDP endpoint on your Nagios XI server. Check the web server access log for requests to the NRDP path from addresses that are not your known check sources.
What to do now
- Upgrade Nagios XI to 2024R1.2 or later.
- Allow the NRDP endpoint only from the hosts and networks that send check results. Block it everywhere else.
- Review NRDP tokens and rotate them if they were shared widely or stored in scripts.
- Check the host for unexpected processes, cron entries and new users owned by the web or Nagios account.
- Keep the Nagios service account on the lowest rights it needs, and keep the server in a management network.
Why it matters
The class is CWE-78, OS command injection. Input that should be data ends up in a command the operating system runs. The result is code execution as the service account, which on a monitoring server often has credentials and network paths to many other hosts.
Monitoring systems are trusted by design. They log in to servers, read metrics and sometimes restart services. An attacker who controls one inherits that trust. Input validation at the NRDP boundary and a tight network allowlist are the two controls that matter here.
Try it yourself
Not every critical is equally urgent. This demo shows how an exploitability check helps you sort your patch queue.
Click through it at your own pace, or open it full screen.
Quick check
What is NRDP?
The Nagios Remote Data Processor. It receives check results from remote systems over HTTP, so it is a network service worth restricting.
Sources
Last reviewed: 19 October 2026.
